Artist-Led Platform Cara Faces AI Data Scraping Attacks, Sparks Collaboration with Former Scraper

Since early 2023, photographer Jingna Zhang and a small crew of volunteers have worked tirelessly to maintain an image-sharing social media and portfolio app called Cara. So far, it has attracted about 1.5 million artists. What drew them to the platform? A shared opposition to the unauthorized use of their work to train AI models and a desire to publicize their art while avoiding exploitation by Big Tech.

But while Cara filters out AI images and offers some minimal protective features, preventing scrapes themselves is nearly impossible. And just this month, beginning on August 13, Cara was subjected to three major scrapes, which spiked its server fees and alarmed creators who had migrated there from platforms like Instagram, where all content is explicitly available to Meta as training data.

The first of these incidents came to light when the individual responsible took to the subreddit r/DefendingAIArt to announce he had obtained a 12-terabyte archive of 12 million works from Cara—more or less its entire library of publicly available images. “It was a fun project,” he wrote under the handle MandarinDawnPoppy994 in his since-deleted post, saying the process cost him less than $10.

“We actually found out about it through our users tagging us,” Zhang tells WIRED, since the scraper was “gloating and looking for other people to join him to do something with the dataset on Reddit,” sparking a fierce debate across AI-related forums about the ethics of what he had done. “I just feel it's targeted and very hurtful,” she adds, noting that “laws are not caught up on” protections against such data harvests, meaning that scrapers can often justify it as technically legal. (Zhang is separately part of two ongoing class actions brought by visual artists, one against Stability AI, Midjourney, and others and the second against Google, alleging that the companies’ image generator tools were trained on their copyrighted work.)

In a surprising turn of events, however, the person who grabbed all the art off Cara would turn out to regret his stunt and agree to collaborate with Zhang on a new open-source tool to protect artists.

In the meantime, unfortunately, other scrapers continued to take advantage of Cara’s vulnerabilities and minimal resources. While a number of AI proponents objected to going after Cara, a few were apparently emboldened by MandarinDawnPoppy994 to carry out what Zhang sees as “copycat” attacks.

A second scraper pulled about 8.5 million links from Cara, as well as metadata like usernames, titles, and tags, and uploaded these to Hugging Face, the AI developer platform. After Hugging Face was bombarded with takedown requests, it responded in a statement that while it would issue a notice to the user, “CaptiveDreamer,” to remove the personal metadata, it could not do the same for the URLs, since “no copies of the artworks are hosted here,” and the links “point to the copies the artists published on Cara.” The company concluded that “further copyright reports on the same basis will not change this outcome.”

Finally, on August 22, a third scraper obtained 123,000 images from Cara, along with text posts and user bios that included personal information, sharing it all on a site called Academic Torrents. Zhang then launched a GoFundMe for legal fees, setting a goal of $120,000, explaining that the money would go toward exploring any and all strategies of defending Cara through cyber and copyright laws. As of Thursday, she has raised more than $100,000, and she says Cara is actively looking for any additional legal assistance.

Zhang is frustrated not only by the scraping but also by the confusion around what she and the Cara team can realistically do to shield artists from malicious actors, saying that some users have already deleted their portfolios and abandoned the site. “We have done the right things within limits without making it horrible to use,” Zhang says of the app’s current safeguards, including some new temporary measures like login gates—which, she adds, aren’t really a solution to an ongoing, internet-wide problem.

And Zhang worries that people blaming her for the string of attacks may not understand that Cara has almost certainly been scraped before, like any other site; it cannot guarantee complete security. “If it makes them feel better, deleting your work and leaving Cara, I support that,” Zhang says of those leaving. “But I don't want to give people the misconception that if they go somewhere else, they are safer, because they're not. Bigger platforms get scraped more, so that makes me feel worse.”

Yet Zhang, who is quick to remind WIRED that she is not a tech founder except by accident, has a newfound ally in this battle: the person who kicked off this month’s scraping frenzy. After a Cara user confronted him and eventually persuaded to delete his dataset, she got in touch to understand his motivations and confirm the deletion. “He felt very bad to see how hurt people were,” Zhang says. “So he decided to help us.”

“Heft” is a student in North America with a background in software and an interest in digital preservation and archival projects. (He requested that we refer to him only by one of his screen names due to doxing and death threats he says he received over the Cara situation.) In a conversation over Discord, Heft tells WIRED that scraping Cara was originally nothing more than a technical project and that he had no intention of making the data public.

Heft says he nevertheless “made a foolish decision to attempt to ragebait with the dataset on Reddit” and “was carried away by trolling in the comments.” He knew it would provoke artists on Cara but did not anticipate the sheer anguish in that community. He saw people “sharing how they were having panic attacks over the scrape, how they deleted their entire portfolios from the internet.” In direct conversations with artists, he gained a greater appreciation of how personal their work was to them and how much they valued their ownership of it.

“In retrospect, not only deliberately targeting Cara but presenting it the way I did in the post was cruel and thoughtless,” Heft says. “I missed the consequences that this would have beyond causing a bit of anger.”

He notes that while he was initially curious as to whether the data could be successfully used in AI training, he never believed it would, since 12 million images “is not a lot to train an image model” and “most commercial AI labs train from large-scale web scrapes” available from open-data organizations like LAION. Random users may dump troves of data on Hugging Face, says Heft, but he considers it “highly unlikely that OpenAI or Anthropic is scanning every new Hugging Face dataset to train on.”

Once shaken out of this theoretical mindset and moved to make amends, Heft joined Cara’s Discord server as a troubleshooter and has been identifying why a number of proposed fixes are unlikely to be successful. “He’s just helping us, you know, taking the time to explain” the structural weak spots that allow for scraping, Zhang says. When a certain tool or design comes up in the conversation, Heft lays out how he can “just break through in like a few minutes, literally,” she says.

Because Heft is “of the belief that no site can be made truly ‘unscrapable,’” as he puts it, he and Zhang are collaborating on a countermeasure that can make a difference after the fact.

The tool, Lantern, allows artists to create a “one-way fingerprint” for their images without storing them on the platform. It “regularly scans new publicly available AI image datasets,” Heft says, and if an artist’s work appears in one, “the artist receives a notification and a link to the dataset so they can request removal or potentially submit a takedown notice.”

Lantern is just getting off the ground, and it’s the kind of imperfect workaround inspired by a regulatory vacuum. But Zhang and Heft are aiming to give artists a little more control and a sense of awareness about how content gets hoovered up across the web, regardless of whether a website forbids this in its terms of service, as Cara does. Plus, since it’s open-source, anybody can contribute to the code.

Zhang’s biggest hope for the fallout from the scraping spree is that it might draw the attention of policymakers looking beyond questions of copyright, which is just one piece of a complicated puzzle.

“Getting attacked by AI is just going to become so, so commonplace,” she says. And most of the time, the attacker won’t say sorry—let alone try to set things right.